Cisco TACACS+ User & Service Manual PDF: Настройка и конфигурация

Prerequisites for TACACS+

Configuring TACACS+ Prerequisites for TACACS+, on page 1 Restrictions for TACACS+, on page 2 Information About TACACS+, on page 2 How to Configure TACACS+, on page 5 Monitoring TACACS+, on page 13 Additional References for TACACS+, on page 13 Feature History for TACACS+, on page 14 Prerequisites for TACACS+ The following are the prerequisites for set up and configuration of switch access with TACACS+ (must be performed in the order presented): 1. Configure the switches with the TACACS+ server addresses. 2. Set an authentication key. 3. Configure the key from Step 2 on the TACACS+ servers. 4. Enable authentication, authorization, and accounting (AAA). 5.

Create a login authentication method list. 6. Apply the list to the terminal lines. 7. Create an authorization and accounting method list. The following are the prerequisites for controlling switch access with TACACS+: • You must have access to a configured TACACS+ server to configure TACACS+ features on your switch. Also, you must have access to TACACS+ services maintained in a database on a TACACS+ daemon typically running on a LINUX or Windows workstation. • You need a system running the TACACS+ daemon software to use TACACS+ on your switch. • To use TACACS+, it must be enabled. • Authorization must be enabled on the switch to be used. Configuring TACACS+ 1

Page 1

TACACS+ Overview

• Users must first successfully complete TACACS+ authentication before proceeding to TACACS+ authorization. • To use any of the AAA commands listed in this section or elsewhere, you must first enable AAA with the aaa new-model command. • At a minimum, you must identify the host or hosts maintaining the TACACS+ daemon and define the method lists for TACACS+ authentication. You can optionally define method lists for TACACS+ authorization and accounting. • The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific port before any of the defined authentication methods are performed.

The only exception is the default method list (which, by coincidence, is named default ). The default method list is automatically applied to all ports except those that have a named method list explicitly defined. A defined method list overrides the default method list. • Use TACACS+ for privileged EXEC access authorization if authentication was performed by using TACACS+. • Use the local database if authentication was not performed by using TACACS+. Restrictions for TACACS+ • VRF-aware DNS resolution is not supported if configured with FQDNs. Information About TACACS+ TACACS+ and Switch Access This section describes TACACS+.

TACACS+ provides detailed accounting information and flexible administrative control over the authentication and authorization processes. It is facilitated through authentication, authorization, accounting (AAA) and can be enabled only through AAA commands. TACACS+ Overview TACACS+ is a security application that provides centralized validation of users attempting to gain access to your switch. TACACS+ provides for separate and modular authentication, authorization, and accounting facilities. TACACS+ allows for a single access control server (the TACACS+ daemon) to provide each service—authentication, authorization, and accounting—independently.

Each service can be tied into its own database to take advantage of other services available on that server or on the network, depending on the capabilities of the daemon. The goal of TACACS+ is to provide a method for managing multiple network access points from a single management service. Your switch can be a network access server along with other Cisco routers and access servers. Configuring TACACS+ Restrictions for TACACS+ Configuring TACACS+ 2

Page 2

TACACS+ Operation

Figure 1: Network Configuration of Typical TACACS+ TACACS+, administered through the AAA security services, can provide these services: • Authentication: Provides complete control of authentication through login and password dialog, challenge and response, and messaging support. The authentication facility can conduct a dialog with the user (for example, after a username and password are provided, to challenge a user with several questions, such as home address, mother’s maiden name, service type, and social security number). The TACACS+ authentication service can also send messages to user screens.

For example, a message could notify users that their passwords must be changed because of the company’s password aging policy. • Authorization: Provides fine-grained control over user capabilities for the duration of the user’s session, including but not limited to setting autocommands, access control, session duration, or protocol support. You can also enforce restrictions on what commands a user can execute with the TACACS+ authorization feature. • Accounting: Collects and sends information used for billing, auditing, and reporting to the TACACS+ daemon. Network managers can use the accounting facility to track user activity for a security audit or to provide information for user billing.

Accounting records include user identities, start and stop times, executed commands (such as PPP), number of packets, and number of bytes. The TACACS+ protocol provides authentication between the switch and the TACACS+ daemon, and it ensures confidentiality because all protocol exchanges between the switch and the TACACS+ daemon are encrypted. TACACS+ Operation When a user attempts a simple ASCII login by authenticating to a switch using TACACS+, this process occurs: 1. When the connection is established, the switch contacts the TACACS+ daemon to obtain a username prompt to show to the user.

The user enters a username, and the switch then contacts the TACACS+ Configuring TACACS+ TACACS+ Operation Configuring TACACS+ 3

Page 3

TACACS+ Configuration Options

daemon to obtain a password prompt. The switch displays the password prompt to the user, the user enters a password, and the password is then sent to the TACACS+ daemon. TACACS+ allows a dialog between the daemon and the user until the daemon receives enough information to authenticate the user. The daemon prompts for a username and password combination, but can include other items, such as the user’s mother’s maiden name. 2. The switch eventually receives one of these responses from the TACACS+ daemon: • ACCEPT: The user is authenticated and service can begin. If the switch is configured to require authorization, authorization begins at this time. • REJECT: The user is not authenticated.

The user can be denied access or is prompted to retry the login sequence, depending on the TACACS+ daemon. • ERROR: An error occurred at some time during authentication with the daemon or in the network connection between the daemon and the switch. If an ERROR response is received, the switch typically tries to use an alternative method for authenticating the user. • CONTINUE: The user is prompted for additional authentication information. After authentication, the user undergoes an additional authorization phase if authorization has been enabled on the switch. Users must first successfully complete TACACS+ authentication before proceeding to TACACS+ authorization. 3.

If TACACS+ authorization is required, the TACACS+ daemon is again contacted, and it returns an ACCEPT or REJECT authorization response. If an ACCEPT response is returned, the response contains data in the form of attributes that direct the EXEC or NETWORK session for that user and the services that the user can access: • Telnet, Secure Shell (SSH), rlogin, or privileged EXEC services • Connection parameters, including the host or client IP address, access list, and user timeouts Method List A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user.

You can use method lists to designate one or more security protocols to be used, thus ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software selects the next method in the list. This process continues until there is successful communication with a listed method or the method list is exhausted. TACACS+ Configuration Options You can configure the switch to use a single server or AAA server groups to group existing server hosts for authentication.

You can group servers to select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list and contains the list of IP addresses of the selected server hosts. Configuring TACACS+ Method List Configuring TACACS+ 4

Page 4